feat: aether-proxy TLS 双栈支持与自签名证书自动生成

- aether-proxy 新增 TLS 模块：自签名证书生成、TLS acceptor 构建、证书 SHA-256 指纹计算
- 代理服务器支持 HTTP+TLS 双栈模式，通过 peek 首字节区分 TLS ClientHello 与普通 HTTP
- 注册与心跳上报 tls_enabled 和 tls_cert_fingerprint 字段
- Python 侧 httpx 代理适配：TLS 代理使用 httpx.Proxy + CERT_NONE ssl_context
- ProxyNode 模型新增 tls_enabled/tls_cert_fingerprint 字段及对应迁移

aether-proxy/src/registration/client.rs

@@ -31,6 +31,10 @@ struct RegisterRequest {
     #[serde(skip_serializing_if = "Option::is_none")]
     region: Option<String>,
     heartbeat_interval: u64,
+    #[serde(skip_serializing_if = "std::ops::Not::not")]
+    tls_enabled: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    tls_cert_fingerprint: Option<String>,
 }
 
 #[derive(Debug, Deserialize)]
@@ -113,6 +117,8 @@ impl AetherClient {
         &self,
         config: &Config,
         public_ip: &str,
+        tls_enabled: bool,
+        tls_cert_fingerprint: Option<&str>,
     ) -> anyhow::Result<String> {
         let url = format!("{}/api/admin/proxy-nodes/register", self.base_url);
         let body = RegisterRequest {
@@ -121,6 +127,8 @@ impl AetherClient {
             port: config.listen_port,
             region: config.node_region.clone(),
             heartbeat_interval: config.heartbeat_interval,
+            tls_enabled,
+            tls_cert_fingerprint: tls_cert_fingerprint.map(|s| s.to_string()),
         };
 
         info!(

aether-proxy/src/registration/heartbeat.rs

@@ -21,6 +21,7 @@ pub async fn run(
     node_id: Arc<RwLock<String>>,
     config: Arc<Config>,
     public_ip: String,
+    tls_fingerprint: Option<String>,
     dynamic: SharedDynamicConfig,
     mut shutdown_rx: watch::Receiver<bool>,
 ) {
@@ -59,7 +60,12 @@ pub async fn run(
                     old_node_id = %current_node_id,
                     "node not found, re-registering"
                 );
-                match client.register(&config, &public_ip).await {
+                match client.register(
+                    &config,
+                    &public_ip,
+                    config.enable_tls,
+                    tls_fingerprint.as_deref(),
+                ).await {
                     Ok(new_id) => {
                         info!(
                             old_node_id = %current_node_id,